How to check if your Apple Silicon Mac is booting securely

https://eclecticlight.co/2025/08/21/how-to-check-if-your-apple-silicon-mac-is-booting-securely/

61•shorden•5h ago

Comments

userbinator•3h ago

s/booting securely/running only the code Apple approves of/g

bapak•3h ago

You can run unverified code if you build it yourself. You can distribute unverified code by just paying $99/year to Apple. Not great, but still no need for specific code approval.

cyberax•2h ago

Not if you want to use some features like bridged networking. For that you need to go and beg Apple for an entitlement. Or you have to disable SIP entirely.

Barbing•2h ago

They respond to the begging as incredibly well as they respond to feedback/bug reports, right?

cyberax•58m ago

To be fair, they _do_ respond well in this particular case. But you have to write an email to a developer somewhere in Apple, as there is no established process.

Gigachad•1h ago

You can run whatever scripts you want without paying anything. Pretty sure the signing thing only applies to .app programs.

arcticbull•1h ago

Not exactly, distribution conversation aside this is specific to kernel extensions. Apple's been moving drivers out of kernel space and into user space for several years [1]. There's a lot of good reasons for doing so, and not a lot of drawbacks. I'd consider this to be a strongly worded API deprecation notice.

[1] https://developer.apple.com/documentation/driverkit

bduhan•2h ago

I had to do this today for a Universal Audio Apollo audio interface. Glad it’s on a dedicated machine.

https://help.uaudio.com/hc/en-us/articles/360057137692-Apple...

Barbing•2h ago

Interesting. They need that for lowest-possible latency? And it should be fairly safe?

arcticbull•1h ago

Assuming they're USB devices they shouldn't be a reason to do this... Apple moved third-party drivers for USB devices and audio HAL extensions to user space, so there's some minor overhead choosing DriverKit over IOKit. Everything I've dug up says it's low single digit percentages. I wouldn't be developing USB drivers against IOKit anymore personally and I'd be looking to move over pretty aggressively before Apple drops the hammer.

Barbing•2h ago

Useful, thank you! Looks like the author just enjoys helping fellow nerds. Nice

8ig8•1h ago

Dr Howard Oakley. I think of him as an OG Mac guy.

ostensible•1h ago

`man csrutil`

Why is choral music harder to appreciate?

Show HN: Sping – An HTTP/TCP latency tool that's easy on the eye

Busy beaver hunters reach numbers that overwhelm ordinary math

From Hackathon to YC

The two versions of Parquet

We put a coding agent in a while loop

Is 4chan the perfect Pirate Bay poster child to justify wider UK site-blocking?

German contest to live in depopulated Soviet-era city proves global hit

Y Combinator files brief supporting Epic Games, says store fees stifle startups

The Unix-Haters Handbook (1994) [pdf]

Ghrc.io appears to be malicious

Trees on city streets cope with drought by drinking from leaky pipes

Show HN: Decentralized Bitcoin Incentives via QR Codes

Burner Phone 101

Making games in Go: 3 months without LLMs vs. 3 days with LLMs

A Brilliant and Nearby One-off Fast Radio Burst Localized to 13 pc Precision

Everything I know about good API design

Bash Strict Mode (2014)

Cloudflare incident on August 21, 2025

Uncle Sam shouldn't own Intel stock

How many paths of length K are there between A and B? (2021)

Show HN: Clearcam – Add AI object detection to your IP CCTV cameras

Halt and Catch Fire Syllabus (2021)

My ZIP isn't your ZIP: Identifying and exploiting semantic gaps between parsers

Claim: GPT-5-pro can prove new interesting mathematics

How to check if your Apple Silicon Mac is booting securely

Comet AI browser can get prompt injected from any site, drain your bank account

Show HN: I Built a XSLT Blog Framework

NASA's Juno mission leaves legacy of science at Jupiter

Iterative DFS with stack-based graph traversal (2024)

Why is choral music harder to appreciate?

Show HN: Sping – An HTTP/TCP latency tool that's easy on the eye

Busy beaver hunters reach numbers that overwhelm ordinary math

From Hackathon to YC

The two versions of Parquet

We put a coding agent in a while loop

Is 4chan the perfect Pirate Bay poster child to justify wider UK site-blocking?

German contest to live in depopulated Soviet-era city proves global hit

Y Combinator files brief supporting Epic Games, says store fees stifle startups

The Unix-Haters Handbook (1994) [pdf]

Ghrc.io appears to be malicious

Trees on city streets cope with drought by drinking from leaky pipes

Show HN: Decentralized Bitcoin Incentives via QR Codes

Burner Phone 101

Making games in Go: 3 months without LLMs vs. 3 days with LLMs

A Brilliant and Nearby One-off Fast Radio Burst Localized to 13 pc Precision

Everything I know about good API design

Bash Strict Mode (2014)

Cloudflare incident on August 21, 2025

Uncle Sam shouldn't own Intel stock

How many paths of length K are there between A and B? (2021)

Show HN: Clearcam – Add AI object detection to your IP CCTV cameras

Halt and Catch Fire Syllabus (2021)

My ZIP isn't your ZIP: Identifying and exploiting semantic gaps between parsers

Claim: GPT-5-pro can prove new interesting mathematics

How to check if your Apple Silicon Mac is booting securely

Comet AI browser can get prompt injected from any site, drain your bank account

Show HN: I Built a XSLT Blog Framework

NASA's Juno mission leaves legacy of science at Jupiter

Iterative DFS with stack-based graph traversal (2024)

How to check if your Apple Silicon Mac is booting securely

Comments